CVE-2026-105931

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator. They do not check whether the caller is permitted to access the tenant, namespace or topic whose data is returned. The endpoints that modify state, which abort a transaction or scale the transaction coordinators, correctly require super-user access and are not affected. As a result, any authenticated user, including one that has been granted no permissions, can read transaction coordinator and transaction information belonging to other tenants. This includes the list of transaction coordinators with the broker service URLs that serve them, transaction coordinator statistics and internal statistics, transaction metadata including the names of the topics and subscriptions a transaction involves and the principal that opened it, the list of long-running transactions on a transaction coordinator, transaction buffer and pending acknowledgement statistics and internal statistics for any topic and subscription, and whether a given message position of a subscription is currently held in a pending transactional acknowledgement. The disclosure of transaction metadata and statistics can only occur when transaction support is enabled in the broker (transactionCoordinatorEnabled, which is disabled by default). When transaction support is disabled, these endpoints return no transaction data; the only residual effect is that one endpoint's error response can reveal whether a named topic exists in another tenant. The impact is limited to disclosure of transaction-related metadata and statistics across tenant boundaries. The issue does not allow reading message contents, modifying or aborting transactions, or changing any configuration. This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Users who cannot upgrade immediately and do not use Pulsar transactions should keep transaction support disabled. Where transactions are required, restricting network access to the broker's admin HTTP endpoints to trusted administrative clients reduces the exposure.

• CWE-862

• https://lists.apache.org/thread.html/82g78kf9q7gmf9m8fvsryq78g4chwktz
• https://pulsar.apache.org/security/CVE-2026-105931/

Published

Oct 21, 2026

Last Modified

Oct 21, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105922A security flaw has been discovered in vllm-project vLLM up …4.3
• CVE-2026-105923A malicious SVG can trigger an integer overflow which in tur…4
• CVE-2026-105926The Pulsar broker serves two schema commands on its binary p…5.3
• CVE-2026-105927The Apache Pulsar WebSocket service allows a WebSocket consu…2.3
• CVE-2026-10593The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unic…6.5
• CVE-2026-105930When package management is enabled, Pulsar Functions, Source…6
• CVE-2026-105932The Apache Pulsar broker admin REST API provides endpoints t…2.3
• CVE-2026-105933Apache Pulsar allows an administrator to require end-to-end …2.3
• CVE-2026-105934The Apache Pulsar broker admin REST API provides a truncate …7.2
• CVE-2026-105935The Pulsar Functions Worker provides a REST API endpoint for…4.9
• CVE-2026-105936The Pulsar Functions worker REST API provides two endpoints …5.3
• CVE-2026-105937Apache Pulsar shadow topics (PIP-180) are topics that read t…8.7